4 ms·
I wonder if the attackers could use what they stole to impersonate FireEye. As in, some org thinks they're contracted/working with FireEye, but they're actually
by akeck 6y ago
I wonder if the attackers could use what they stole to impersonate FireEye. As in, some org thinks they're contracted/working with FireEye, but they're actually working with this nation state doing intelligence against the org.
- gist 6y agoWhy impersonate Fireeye even? Just start a legitimate company, gain customers and then use that as a basis to gather what you need. The employees wouldn't know this they'd think they are working for a legitimate company. The bad actors who set it up would just have access to whatever they needed to do what they needed to do. This would take years of work to pull off but could be done.
- walls 6y agoAn APT group was doing this up until ~2016 under the name 'Combi Security' https://nakedsecurity.sophos.com/2019/09/13/fin7-sysadmin-pleads-guilty-to-running-it-for-billion-dollar-crime-syndicate/ https://nakedsecurity.sophos.com/2019/09/13/fin7-sysadmin-pl...